Data or information security often involves controlling access to specific data by specific entities. Given a set of data, the data's owner may specify which entities are allowed access to the data, or how an entity requesting access to the data should be authenticated before granting it access to the data. There are various ways to control access to a specific set of data. For example, the data may be protected with an access code (e.g., a password or an access token). Only an entity who is able to supply the correct access code is grant access to the data. As another example, each time an entity requests access to the data, an explicit request may be sent to the data's owner, giving the owner the choice of granting or denying the entity access to the data.
A social-networking system, such as a social-networking website, enables its users to interact with it and with each other through the system. The social-networking system may create and store a record, often referred to as a user profile, in connection with the user. The user profile may include a user's demographic information, communication channel information, and personal interests. The social-networking system may also create and store a record of a user's relationship with other users in the social-networking system (e.g., social graph), as well as provide services (e.g., wall-posts, photo-sharing, or instant messaging) to facilitate social interaction between users in the social-networking system.
Social-networking systems may provide application programming interfaces that allow developers to configure applications that access information maintained by the social-networking system, such as profile information of a user, the identity of social network contacts of a user, a news feed of a user, and the like. Such applications may be web-based applications hosted by a server accessed by browser clients, or may be native applications locally installed on a client device (or a combination of the foregoing). Indeed, in some social-networking systems, a user may add so-called canvas applications to his or her user profile. Canvas applications may be third party applications that a user may access by clicking on a link or other control provided by a web page of the social-networking system. The canvas application may be hosted by a third party system and run in an iframe (or other section) of a web page provided by the social-networking system.